Malicious
Malicious

eb95d32cb70ecff11a37e5dac274c58e

Share on LinkedIn Add to favorites
Re-Scan
Delete
PE Executable
MD5: eb95d32cb70ecff11a37e5dac274c58e
Size: 49.66 KB
application/x-dosexec
Summary by MalvaGPT
Characteristics

Symbol Obfuscation Score

Very high

Hash
 Hash Value
MD5
eb95d32cb70ecff11a37e5dac274c58e
Sha1
2acd2dec3681c749116b68ac4d12c15b611b5104
Sha256
5680ad54e90963f572f02cf77efc673828d5992bb8a935e83015ef26daf8d9b6
Sha384
cfbd565328028d3ccb55c4559fbf162cf1209b790efce46b1834c5b27b8fa8eabc843068b4cde6c0f20b280830197fc2
Sha512
f1866bcefba63d6675248c039123d0126e1920c7c6a7663d6be01d0b3f7ee02d10cf7019348a2ec8314ca3940c22cb3b52b119779a4bd7a6e03d3627e7633432
SSDeep
768:WqDjNbXgQu2GuU/UK8fbegsYC774l0bIegckW9vHnmlXPuYyLcYI6OCt2tYcFmVY:WKGuU/J4be573bIqk8yfqL86OAKmVcl
TLSH
F5234D043BDD813AE2BD5F78ADF2214586BAF6233603D55A3CC841D64B23BC6CA516F6

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
eb95d32cb70ecff11a37e5dac274c58e
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Malware Configuration - AsyncRAT config.
Config. Field
 Value
Key (AES_256)

a0gzRDFLdFJLUFRVM3VIdm5HRnhoWjlVU2FpRXQzRkw=
Pastebin

-
Certificate

MIIE8jCCAtqgAwIBAgIQAOD7cV0bLhEBFPJUOT6P5TANBgkqhkiG9w0BAQ0FADAaMRgwFgYDVQQDDA9Bc3luY1JBVCBTZXJ2ZXIwIBcNMjYwNTA2MTgwNzQ2WhgPOTk5OTEyMzEyMzU5NTlaMBoxGDAWBgNVBAMMD0FzeW5jUkFUIFNlcnZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBALbogjSQruWZ6e0W50t6xywM9nWyeqB6w3E9sv4fVJXMYwr9+6VRn2+Ki0AZeEzTe+wEfgJ4mqX43+hYHMOORcyIlSPFiGT4Mmkr4PFr4j2qkdDWmIXU+8ntHW11259TEzscd4tCXZTcPwxqZvNuzYcHPIRieF+7mwR1Sd8I+vK0sb/6qxyvs4IBmRHvwfMjNQCqAns0/hG9udrcKLOA1VH1THpUs0lqqsOcAus0jQyZ+JBESBzrKlyZLRq+DnP6nHQMZfK5Y/tsNgI+QDZtCOXhRmhV+/75j8jI9jw/M0zfefSRXrgH3EdqyJ1DDJD3opv8jvSD6LjYjV1gSqNESwCysBnlOROWj4TEH9/J1T2xumjHOB+jOHfT1lGVjKt07vJv4sPQmG29cnZkgvX+04awtESinsWd/N3TLSPzQcmCxfcby4mOcA9ENpqxgpbHfnF6iwlMySHUx7Zev7a88+8viNiCgPCiMR+KZ2skp+q4Glv6S1ps+imkvFmpw1Mkzchw88kqNNCNmZfv0iM99TcechVO18QwHQOEgqd5dnrMsCz1wFSG4cTBR2yQIUCbwkp4WLVdTLX9wnXLuAY9/9pPpmVHS5lX1QAkf174nk+q8G7jiC34z5WsQhBPIrbgz0f35PjG7aWnoLCQmrmrA0FfWbSMqJPz8ACnZG1hWV59AgMBAAGjMjAwMB0GA1UdDgQWBBTEvxDfZyOhxLqEqvaD9fMUgotbojAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQBdhNBK8ZWmC6/XFqR6PyP3rCng2FylxxPWwjR0Y28fqDYFCigKuJ47wvF6VrJMD53xeLVODBbpVLHatiZFty39HWlool+VBGOAUoT/ZLuEZngviKIDWQMBJ/VGRj5LbzUV4ewAp4pj5nyjCxyR6NKJInwXo9U9SCENkWZgPP23CBzuoIY6eLaDImIlJdhZy1MEgqZgJInL802g1tt8twM3aAnWOHqd4dynfwnsUbGmiLYEOFDPkwMtV60dm3faknS7zX5FRwcyUpfvT6O3q8CrNOVVxgV1W7llDB8sZ7f8r7a22uVZAGMVUhW8bUVgPJbYPX525ihinHeNGuA+oG4h36Jecb/FRGOud/DkW3A/TfVkP/CD2QI2Zcebc4zdTxplERVtQruP+pIEu5dtFbl1izw0LFQ33v5yTHHYktLSFR6Q3TDIFArSPjDZ+M3E4oWg9uYWaaR0ZN0lluYEtTHdPp8KnVDpI4vUNph1o/Ku00DOeMC0Ji7cT/Gt0RFJwxplVxHJgH5WXhaIbQWqu+pEpRQvaHHPZenIrzklP96bbs92mpS0i2ehhJKJRaTNWl/1ENNE8qTy133E1oqqCrRFp4W2PaavI8FzO1GqUAAATIE8MmbScEWxX8cMCHgoQhMa8/nAIgzIyIr84auhmRQCyCMRCA3rKPAxEY6kYXfYnA==
ServerSignature

Y43p/QNNvb7AY7v4bqkXbpA2HnG7FgX/dO6fBW6TkBVcb1Yz727aIbfUL4e4e9Fc9zv6GtydOIaZt5wmPxkGnbXGoZJtf6uwZStYav/wKauWhEzIBTfR+AyyVWHLyabQ3KQvl7mC5j65Q2XAxFzL7OwNMa614XHRdUsZb7kdKI7FgsvE7GL6NH/ofZij3/fbZY6vm9EZZwyODrdna/7B/d/mHi18nA/IszB3U2J2TeLjC3z87HrYJXUx6SkEn/GmuFA+lfMDKAC9cLC3zzCSsXxSD087t3m8PvUPzUySgj5LIbNoH8WoaUCnLBAyWV5+9AkkcJBnTHVHfWsZsevy/llmwS9Y4aBKMzbyLDweSyCBf88uW1R+hkknfkb1zdqirtbR51h2jOawpSPNjnePh/ZuW2Vkz1wvfMKm/dOEryGa8Y32FN4NihjySf5EHEn8fwZfXJEgF7i3t2VlM+nFOcXr1RA7/uD2qYTYYH1v91rf5tgEW5ZAWLI+qItSP5X1LGLB7jU8eTu8ZMhiCzCEWc+BWkZc9ayP6HlTBbjRpQgEJmElX9JgvnSAlMCzTSHIIDAbgxsHZ1JXpE7cPGwDBcgkET6La8q5+fczYTbRhY7MleGet2VfMSlfaD4JS4mOYKCcy7rUnNvy2cgRGn7KufoRQBZuWRf3stpKrYp5nk4=
Install

true
BDOS

true
Anti-VM

true
Install File

ChromeUpdate.exe
Install-Folder

%AppData%
Version

0.5.6A
Hosts

ikx.uk.com
Ports

22,23,80,443,6607,8080,8443
Mutex

lejkytfotaniitj
Delay

5
Informations
Name
 Value
Info

PE Detect: PeReader OK (file layout)
Module Name

ZUpivtmVibLxqTK
Full Name

ZUpivtmVibLxqTK
EntryPoint

System.Void NIRCWPgFJUO.QhbqGjmESCDW::Main()
Scope Name

ZUpivtmVibLxqTK
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

Stub
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.0,Profile=Client
Total Strings

130
Main Method

System.Void NIRCWPgFJUO.QhbqGjmESCDW::Main()
Main IL Instruction Count

53
Main IL

ldc.i4.0 <null> stloc.0 <null> br.s IL_0012: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String NIRCWPgFJUO.ZSrsSfzRIvNYhRsN::devFafgetqOTT call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0004: ldc.i4 1000 call System.Boolean NIRCWPgFJUO.ZSrsSfzRIvNYhRsN::KlFKeYwIPZ() brtrue.s IL_002C: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean VsSzBuEBioXYJxHg.RnXXpQMzPN::hvbuABMCYtNm() brtrue.s IL_003A: ldsfld System.String NIRCWPgFJUO.ZSrsSfzRIvNYhRsN::rcvffNdkpgIU ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String NIRCWPgFJUO.ZSrsSfzRIvNYhRsN::rcvffNdkpgIU call System.Boolean System.Convert::ToBoolean(System.String) brfalse.s IL_004B: ldsfld System.String NIRCWPgFJUO.ZSrsSfzRIvNYhRsN::QdbPRGordgYPjCt call System.Void VsSzBuEBioXYJxHg.DbMaxQgDxMK::vurdfrUCbaIte() ldsfld System.String NIRCWPgFJUO.ZSrsSfzRIvNYhRsN::QdbPRGordgYPjCt call System.Boolean System.Convert::ToBoolean(System.String) brfalse.s IL_005C: ldsfld System.String NIRCWPgFJUO.ZSrsSfzRIvNYhRsN::gnrYahxHNRtpu call System.Void aOythYpLPSCo.guUWSjcwLsVK::qhGQYtGGJFxB() ldsfld System.String NIRCWPgFJUO.ZSrsSfzRIvNYhRsN::gnrYahxHNRtpu call System.Boolean System.Convert::ToBoolean(System.String) brfalse.s IL_0074: call System.Void VsSzBuEBioXYJxHg.AVGGTIIHVFRuBGG::oHYkGHhrox() call System.Boolean VsSzBuEBioXYJxHg.AVGGTIIHVFRuBGG::nIqWDsmyfdIMo() brfalse.s IL_0074: call System.Void VsSzBuEBioXYJxHg.AVGGTIIHVFRuBGG::oHYkGHhrox() call System.Void VsSzBuEBioXYJxHg.XofpeFsgkffI::xeYPesNvvrVpRHXvi() call System.Void VsSzBuEBioXYJxHg.AVGGTIIHVFRuBGG::oHYkGHhrox() newobj System.Void VsSzBuEBioXYJxHg.wvVleGsZzDaOa::.ctor() call System.String VsSzBuEBioXYJxHg.wvVleGsZzDaOa::ToguALZQMLkux() pop <null> leave.s IL_0089: call System.Boolean zsClfXuuYnJVm.CEyIYeQJMO::get_IsConnected() pop <null> leave.s IL_0089: call System.Boolean zsClfXuuYnJVm.CEyIYeQJMO::get_IsConnected() call System.Boolean zsClfXuuYnJVm.CEyIYeQJMO::get_IsConnected() brtrue.s IL_009A: newobj System.Void System.Random::.ctor() call System.Void zsClfXuuYnJVm.CEyIYeQJMO::pNCmCJoLXTj() call System.Void zsClfXuuYnJVm.CEyIYeQJMO::mjMMEzTYkwFD() newobj System.Void System.Random::.ctor() ldc.i4 1000 ldc.i4 5000 callvirt System.Int32 System.Random::Next(System.Int32,System.Int32) call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0089: call System.Boolean zsClfXuuYnJVm.CEyIYeQJMO::get_IsConnected()
Module Name

ZUpivtmVibLxqTK
Full Name

ZUpivtmVibLxqTK
EntryPoint

System.Void NIRCWPgFJUO.QhbqGjmESCDW::Main()
Scope Name

ZUpivtmVibLxqTK
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

Stub
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.0,Profile=Client
Total Strings

130
Main Method

System.Void NIRCWPgFJUO.QhbqGjmESCDW::Main()
Main IL Instruction Count

53
Main IL

ldc.i4.0 <null> stloc.0 <null> br.s IL_0012: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String NIRCWPgFJUO.ZSrsSfzRIvNYhRsN::devFafgetqOTT call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0004: ldc.i4 1000 call System.Boolean NIRCWPgFJUO.ZSrsSfzRIvNYhRsN::KlFKeYwIPZ() brtrue.s IL_002C: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean VsSzBuEBioXYJxHg.RnXXpQMzPN::hvbuABMCYtNm() brtrue.s IL_003A: ldsfld System.String NIRCWPgFJUO.ZSrsSfzRIvNYhRsN::rcvffNdkpgIU ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String NIRCWPgFJUO.ZSrsSfzRIvNYhRsN::rcvffNdkpgIU call System.Boolean System.Convert::ToBoolean(System.String) brfalse.s IL_004B: ldsfld System.String NIRCWPgFJUO.ZSrsSfzRIvNYhRsN::QdbPRGordgYPjCt call System.Void VsSzBuEBioXYJxHg.DbMaxQgDxMK::vurdfrUCbaIte() ldsfld System.String NIRCWPgFJUO.ZSrsSfzRIvNYhRsN::QdbPRGordgYPjCt call System.Boolean System.Convert::ToBoolean(System.String) brfalse.s IL_005C: ldsfld System.String NIRCWPgFJUO.ZSrsSfzRIvNYhRsN::gnrYahxHNRtpu call System.Void aOythYpLPSCo.guUWSjcwLsVK::qhGQYtGGJFxB() ldsfld System.String NIRCWPgFJUO.ZSrsSfzRIvNYhRsN::gnrYahxHNRtpu call System.Boolean System.Convert::ToBoolean(System.String) brfalse.s IL_0074: call System.Void VsSzBuEBioXYJxHg.AVGGTIIHVFRuBGG::oHYkGHhrox() call System.Boolean VsSzBuEBioXYJxHg.AVGGTIIHVFRuBGG::nIqWDsmyfdIMo() brfalse.s IL_0074: call System.Void VsSzBuEBioXYJxHg.AVGGTIIHVFRuBGG::oHYkGHhrox() call System.Void VsSzBuEBioXYJxHg.XofpeFsgkffI::xeYPesNvvrVpRHXvi() call System.Void VsSzBuEBioXYJxHg.AVGGTIIHVFRuBGG::oHYkGHhrox() newobj System.Void VsSzBuEBioXYJxHg.wvVleGsZzDaOa::.ctor() call System.String VsSzBuEBioXYJxHg.wvVleGsZzDaOa::ToguALZQMLkux() pop <null> leave.s IL_0089: call System.Boolean zsClfXuuYnJVm.CEyIYeQJMO::get_IsConnected() pop <null> leave.s IL_0089: call System.Boolean zsClfXuuYnJVm.CEyIYeQJMO::get_IsConnected() call System.Boolean zsClfXuuYnJVm.CEyIYeQJMO::get_IsConnected() brtrue.s IL_009A: newobj System.Void System.Random::.ctor() call System.Void zsClfXuuYnJVm.CEyIYeQJMO::pNCmCJoLXTj() call System.Void zsClfXuuYnJVm.CEyIYeQJMO::mjMMEzTYkwFD() newobj System.Void System.Random::.ctor() ldc.i4 1000 ldc.i4 5000 callvirt System.Int32 System.Random::Next(System.Int32,System.Int32) call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0089: call System.Boolean zsClfXuuYnJVm.CEyIYeQJMO::get_IsConnected()
Artefacts
Name
 Value
Key (AES_256)

a0gzRDFLdFJLUFRVM3VIdm5HRnhoWjlVU2FpRXQzRkw=
CnC

ikx.uk.com
Ports

22
Ports

23
Ports

80
Ports

443
Ports

6607
Ports

8080
Ports

8443
Mutex

lejkytfotaniitj
eb95d32cb70ecff11a37e5dac274c58e (49.66 KB)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙